PU
Product
ProfileGrid – User Profiles, Groups and Communities
25
CVEs
0
On KEV
9.8
Max CVSS
0
New 30D
Severity mix
Critical 1High 6Medium 18Low 0
Watch
Add ProfileGrid – User Profiles, Groups and Communities to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2026-12073 | 9.8 | Jun 30 | ProfileGrid - User Profiles, Groups and Communities <= 5.9.9.5 - Unauthenticated Privilege Escalation via Email Overwrite Affected: through 5.9.9.5 |
| CVE-2025-0724 | 8.8 | Mar 22 | ProfileGrid – User Profiles, Groups and Communities <= 5.9.4.5 - Authenticated (Subscriber+) PHP Object Injection Affected: through 5.9.4.5 |
| CVE-2024-6411 | 8.8 | Jul 10 | ProfileGrid – User Profiles, Groups and Communities <= 5.8.9 - Authenticated (Subscriber+) Authorization Bypass to Privilege Escalation Affected: through 5.8.9 |
| CVE-2023-3714 | 8.8 | Jul 18 | ProfileGrid <= 5.5.2 - Missing Authorization to Arbitrary Group Option Modification and Privilege Escalation Affected: through 5.5.2 |
| CVE-2023-3713 | 8.8 | Jul 18 | ProfileGrid <= 5.5.1 - Authenticated (Subscriber+) Arbitrary Option Update Affected: through 5.5.1 |
| CVE-2024-10900 | 8.1 | Nov 20 | ProfileGrid – User Profiles, Groups and Communities <= 5.9.3.6 - Missing Authorization to Authenticated (Subscriber+) Arbitrary User Meta Deletion Affected: through 5.9.3.6 |
| CVE-2026-4609 | 7.1 | May 13 | ProfileGrid <= 5.9.8.4 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Group Joining Affected: through 5.9.8.4 |
| CVE-2026-4608 | 6.5 | May 13 | ProfileGrid <= 5.9.8.4 - Authenticated (Subscriber+) SQL Injection via 'rid' Parameter Affected: through 5.9.8.4 |
| CVE-2025-0723 | 6.5 | Mar 22 | ProfileGrid – User Profiles, Groups and Communities <= 5.9.4.7 - Authenticated (Subscriber+) SQL Injection Affected: through 5.9.4.7 |
| CVE-2026-4610 | 6.4 | Jun 23 | ProfileGrid <= 5.9.9.2 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Message Content Affected: through 5.9.9.2 |
| CVE-2025-6977 | 6.1 | Jul 16 | ProfileGrid – User Profiles, Groups and Communities <= 5.9.5.4 - Reflected Cross-Site Scripting via 'pm_get_messenger_notification' function Affected: through 5.9.5.4 |
| CVE-2024-13741 | 5.4 | Feb 18 | ProfileGrid – User Profiles, Groups and Communities <= 5.9.4.2 - Authenticated (Subscriber+) Limited Server-Side Request Forgery Affected: through 5.9.4.2 |
| CVE-2024-8861 | 5.4 | Sep 26 | ProfileGrid – User Profiles, Groups and Communities <= 5.9.3.2 - Authenticated (Contributor+) Stored Cross-Site Scripting Affected: through 5.9.3.2 |
| CVE-2026-1271 | 5.3 | Feb 5 | ProfileGrid <= 5.9.7.2 - Insecure Direct Object Reference to Authenticated (Subscriber+) Arbitrary User Profile and Cover Image Modification Affected: through 5.9.7.2 |
| CVE-2023-3404 | 4.9 | Aug 31 | ProfileGrid <= 5.5.0 - Hardcoded Encryption Key Affected: through 5.5.0 |
| CVE-2026-4607 | 4.3 | May 13 | ProfileGrid <= 5.9.8.4 - Missing Authorization to Authenticated (Subscriber+) Group Settings Modification Affected: through 5.9.8.4 |
| CVE-2026-2494 | 4.3 | Mar 7 | ProfileGrid <= 5.9.8.2 - Cross-Site Request Forgery to Group Membership Request Approval/Denial Affected: through 5.9.8.2 |
| CVE-2026-2488 | 4.3 | Mar 7 | ProfileGrid <= 5.9.8.1 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Message Deletion Affected: through 5.9.8.1 |
| CVE-2025-13416 | 4.3 | Feb 5 | ProfileGrid – User Profiles, Groups and Communities <= 5.9.7.2 - Missing Authorization to Authenticated (Subscriber+) Arbitrary User Suspension Affected: through 5.9.7.2 |
| CVE-2025-1408 | 4.3 | Mar 22 | ProfileGrid – User Profiles, Groups and Communities <= 5.9.4.4 - Missing Authorinzation to Authenticated (Subscriber+) Join Group Requests Management Affected: through 5.9.4.4 |
| CVE-2024-13740 | 4.3 | Feb 18 | ProfileGrid – User Profiles, Groups and Communities <= 5.9.4.2 - Insecure Direct Object Reference to Authenticated (Subscriber+) Private Messages Disclosure Affected: through 5.9.4.2 |
| CVE-2024-6410 | 4.3 | Jul 10 | ProfileGrid <= 5.8.9 - Authenticated (Subscriber+) Insecure Direct Object Reference Affected: through 5.8.9 |
| CVE-2024-5453 | 4.3 | Jun 5 | ProfileGrid <= 5.8.6 - Missing Authorization Affected: through 5.8.6 |
| CVE-2024-3606 | 4.3 | May 2 | ProfileGrid – User Profiles, Memberships, Groups and Communities <= 5.8.3 - Missing Authorization Affected: through 5.8.3 |
| CVE-2023-3403 | 4.3 | Jul 18 | ProfileGrid <= 5.5.1 - Missing Authorization to User Import Affected: through 5.5.1 |
Showing 25
